MALICIOUS
124
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The file was detected as a phishing trojan by ClamAV. Static analysis revealed it functions as a link farm, with numerous embedded URLs pointing to various domains, many of which appear to be compromised or disposable hosting. The heuristic 'PDF_SEO_DISPOSABLE_LINK_FARM' specifically indicates a non-clustered link farm on disposable hosting, suggesting a malicious intent for SEO manipulation or to host phishing lures.
Machine Learning
- Nyx PDF Classifier suspicious score 0.4750
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
PDF link farm points to compromised-WordPress upload storage medium PDF_COMPROMISED_CMS_UPLOAD_LINK_FARMPDF contains multiple clickable links, across many distinct hosts, whose targets are random-slug files parked in the upload directories of vulnerable WordPress form plugins (FormCraft, Super Forms). This is the hallmark of the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains hosted on compromised sites. The PDF itself carries no exploit — the risk is the linked destinations.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://emeat.ru/var/files/fatofudutobolujur.pdf In PDF document text
- http://biomisszio.hu/tmp/98819147890.pdfIn PDF document text
- https://motionslam.com/wp-content/plugins/super-forms/uploads/php/files/a1f8a18145462fe874cd35eb879a9c2e/25694598715.pdfIn PDF document text
- https://hmv.ir/wp-content/plugins/formcraft/file-upload/server/content/files/160d882aaf1657---6095036211.pdfIn PDF document text
- http://el-master.ru/userfiles/file/dopixuxup.pdfIn PDF document text
- http://www.191seo.com/wp-content/plugins/formcraft/file-upload/server/content/files/160acc84400712---vetuzubelogaref.pdfIn PDF document text
- http://nhs1966reunion.com/clients/1/1c/1ca8f1639ee69cd7806809ed3bcda9bb/File/48220703971.pdfIn PDF document text
- https://maspacientes.es/wp-content/plugins/super-forms/uploads/php/files/ru3fgnup107gnpfq86rjv8mr5n/jaxowopemot.pdfIn PDF document text
- https://swimproject.eu/wp-content/plugins/super-forms/uploads/php/files/26d151ffcb0b560963b0e40059cff905/vejidazemarojisa.pdfIn PDF document text
- https://popcouncilinstitute.org/wp-content/plugins/super-forms/uploads/php/files/b17df50bbd012a4b4d2eba3113279a7c/maritumowejiba.pdfIn PDF document text
- http://viral-list-machine.com/ckfinder/userfiles/publics/files/71423592771.pdfIn PDF document text
- https://www.energetisch-therapeut-estie.nl/wp-content/plugins/formcraft/file-upload/server/content/files/16081f689a928a---jirunelubepumodugobajir.pdfIn PDF document text
- https://emergent-partners.com/wp-content/plugins/formcraft/file-upload/server/content/files/160781ab8bd63d---nuketaduva.pdfIn PDF document text
- https://www.colegiodesafio.net/home/wp-content/plugins/formcraft/file-upload/server/content/files/160a918bac5af3---buzetopenawogal.pdfIn PDF document text
- https://nationalcardsolutions.com/wp-content/plugins/formcraft/file-upload/server/content/files/160ac6557b8ef2---nutagapipafutokudi.pdfIn PDF document text
- http://didocrosby.com/imagenes/file/tefukuzodidi.pdfIn PDF document text
- https://kachhiproperties.com/wp-content/plugins/super-forms/uploads/php/files/apvnveo62ufo87geubdg0e84b5/76564106434.pdfIn PDF document text
- https://lisacutler.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a69b02b8805---14608370545.pdfIn PDF document text
- https://www.uniqueartzz.com/wp-content/plugins/super-forms/uploads/php/files/kl41773qkpvr67ouk35ohpqfm9/37570200751.pdfIn PDF document text
- http://wych123.com/upload/files/murewofazufo.pdfIn PDF document text
- http://www.supercarrentalsofmiami.com/wp-content/plugins/formcraft/file-upload/server/content/files/160c0632d04ed7---94861555172.pdfIn PDF document text
- https://lorenzonimmigrationlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/160a3184950dba---65750172503.pdfIn PDF document text
- http://futurepoolandspa.com/ckfinder/userfiles/files/lonodavutanikivogonotonev.pdfIn PDF document text
- https://gute-reise.ru/i/files/files/79535355414.pdfIn PDF document text
- http://sotel-perm.ru/site/file/marizitatejasi.pdfIn PDF document text
- https://feedproxy.google.com/~r/skout/mBVl/~3/3CAf4wW3hvY/uplcv?utm_term=causes+and+effects+of+stressPDF link annotation
- http://dejavu.sourceforge.netIn PDF document text
- http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000f230.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF230 | 10464 bytes |
SHA-256: 093db2d0db92b00770884dcad634542564398254b4838f1b7bf86f46b7f7fcc1 |
|||
font_01_sfnt_off00010a1d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x10A1D | 16728 bytes |
SHA-256: d29c45eb6e0955fbd82693d778451a08fd780b5c86f0774660ef969ef517694d |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.